Interprocedural control flow analysis of first-order programs with tail-call optimization

Debray, Saumya; Proebsting, Todd A.

doi:10.1145/262004.262006

Cited by 12 publications

(3 citation statements)

References 13 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…For example, event handlers registered for location change will be invoked when the location of the phone changes. Since there is no main method to organize these callbacks together, discontinuity will occur if we construct the call graph of a component in a traditional way [21,8,32,23,20] . Besides, since these entry points are invoked in an event-driven manner, we cannot pre-determine their order of execution.…”

Section: Call Graph and Invocation Chainmentioning

confidence: 99%

WeChecker

Cui

Wang

Hui

et al. 2015

Proceedings of the 8th ACM Conference on Security &Amp; Privacy in Wireless and Mobile Networks

View full text Add to dashboard Cite

Due to the rapid increase of Android apps and their wide usage to handle personal data, a precise and large-scaling checker is in need to validate the apps' permission flow before they are listed on the market. Several tools have been proposed to detect sensitive data leaks in Android apps. But these tools are not applicable to large-scale analysis since they fail to deal with the arbitrary execution orders of different event handlers smartly. Event handlers are invoked by the framework based on the system state, therefore we cannot pre-determine their order of execution. Besides, since all exported components can be invoked by an external app, the execution orders of these components are also arbitrary. A naive way to simulate these two types of arbitrary execution orders yields a permutation of all event handlers in an app. The time complexity is O(n!) where n is the number of event handlers in an app. This leads to a high analysis overhead when n is big. To give an illustration, CHEX [10] found 50.73 entry points of 44 unique class types in an app on average. In this paper we propose an improved static taint analysis to deal with the challenge brought by the arbitrary execution orders without sacrificing the high precision. Our analysis does not need to make permutations and achieves a polynomial time complexity. We also propose to unify the array and map access with object reference by propagating access paths to reduce the number of false positives due to field-insensitivity and over approximation of array access and map access.We implement a tool, WeChecker, to detect privilege escalation vulnerabilities [7] in Android apps. WeChecker achieves 96% precision and 96% recall in the state-of-the-art test suite DriodBench (for compairson, the precision and recall of FlowDroid [1] are 86% and 93%, respectively). The evaluation of WeChecker on real apps shows that it is efficient (average analysis time of each app: 29.985s) and fits for large-scale checking.

show abstract

Section: Call Graph and Invocation Chainmentioning

confidence: 99%

WeChecker

Cui

Wang

Hui

et al. 2015

Proceedings of the 8th ACM Conference on Security &Amp; Privacy in Wireless and Mobile Networks

View full text Add to dashboard Cite

show abstract

“…We do this backward search by transitively adding a summary edge fromς 3 toς 2 (line 25). Ifς 2 is a tail call (line 20), we find its successors and record the call in TCallers (lines [21][22][23]. If a successor ofς 2 goes to an exit, we propagate a summary transitively (line 24).…”

Section: Summarizationmentioning

confidence: 99%

CFA2: A Context-Free Approach to Control-Flow Analysis

Vardoulakis¹,

Shivers²

2010

Programming Languages and Systems

View full text Add to dashboard Cite

Abstract. In a functional language, the dominant control-flow mechanism is function call and return. Most higher-order flow analyses, including k -CFA, do not handle call and return well: they remember only a bounded number of pending calls because they approximate programs with control-flow graphs. Call/return mismatch introduces precisiondegrading spurious control-flow paths and increases the analysis time.We describe CFA2, the first flow analysis with precise call/return matching in the presence of higher-order functions and tail calls. We formulate CFA2 as an abstract interpretation of programs in continuationpassing style and describe a sound and complete summarization algorithm for our abstract semantics. A preliminary evaluation shows that CFA2 gives more accurate data-flow information than 0CFA and 1CFA.

show abstract

“…However we view the need for such a subsequent analysis as a strong indication of a mismatch between the two analysis formulations. Debray and Proebsting [43] have investigated such a "return analysis" for a first-order language with tail-call optimization. The present paper builds a semantics-based CFA that determines such information, and for a higher-order language.…”

Section: Related Workmentioning

confidence: 99%

Control-flow analysis of function calls and returns by abstract interpretation

Midtgaard

Jensen

2009

SIGPLAN Not.

View full text Add to dashboard Cite

. Control-flow analysis of function calls and returns by abstract interpretation. Information and Computation, Elsevier, 2012, 2012, pp.49-76. 10.1016/j.ic.2011 AbstractAbstract interpretation techniques are used to derive a control-flow analysis for a simple higher-order functional language. The analysis approximates the interprocedural control-flow of both function calls and returns in the presence of first-class functions and tail-call optimization. In addition to an abstract environment, the analysis computes for each expression an abstract call-stack, effectively approximating where function calls return. The analysis is systematically derived by abstract interpretation of the stack-based C a EK abstract machine of Flanagan et al. using a series of Galois connections. We prove that the analysis is equivalent to an analysis obtained by first transforming the program into continuation-passing style and then performing control flow analysis of the transfored program. We then show how the analysis induces an equivalent constraint-based formulation, thereby providing a rational reconstruction of a constraint-based CFA from abstract interpretation principles.

show abstract

Interprocedural control flow analysis of first-order programs with tail-call optimization

Cited by 12 publications

References 13 publications

WeChecker

WeChecker

CFA2: A Context-Free Approach to Control-Flow Analysis

Control-flow analysis of function calls and returns by abstract interpretation

Contact Info

Product

Resources

About